CVE-2022-27488: Fortinet Fortiai

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

A cross-site request forgery (CSRF) in Fortinet FortiVoiceEnterprise version 6.4.x, 6.0.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.0 through 6.2.7, 6.0.x, FortiMail version 7.0.0 through 7.0.3, 6.4.0 through 6.4.6, 6.2.x, 6.0.x FortiRecorder version 6.4.0 through 6.4.2, 6.0.x, 2.7.x, 2.6.x, FortiNDR version 1.x.x allows a remote unauthenticated attacker to execute commands on the CLI via tricking an authenticated administrator to execute malicious GET requests.

Affected products

• Fortinet Fortiai: version 1.1.0 only; version 1.5.3 only
• Fortinet FortiMail: from 6.0.0, up to and including 6.0.12; from 6.2.0, up to and including 6.2.9; from 6.4.0, up to and including 6.4.6; from 7.0.0, up to and including 7.0.3
• Fortinet Fortindr: from 7.0.0, up to and including 7.0.4; version 7.1.0 only
• Fortinet Fortirecorder: from 2.6.0, up to and including 2.6.3; from 2.7.0, up to and including 2.7.7; from 6.0.0, up to and including 6.0.11; from 6.4.0, up to and including 6.4.2
• Fortinet Fortiswitch: from 6.0.0, up to and including 6.0.7; from 6.2.0, up to and including 6.2.7; from 6.4.0, up to and including 6.4.10; from 7.0.0, up to and including 7.0.4
• Fortinet Fortivoice: from 6.0.0, up to and including 6.0.11; from 6.4.0, up to and including 6.4.7

Published 2023-12-13. Last modified 2026-06-17.